cobaltstrike | a0a001e005239910726efdff46be78a9c2c915a5e744dac8f1ac24c700a986c1 | Triage

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22-12-2024 10:52

Sharing

Report Analysis Logs

General

Target

TS-A901.exe
Size

337KB
MD5

3050de289706d4fefe60f97909138e6d
SHA1

5fb4a5b76c31b8f07f010d0f4a77364c249c09cf
SHA256

ea88766a215f1d80a2aa5a32cad7fde54150983b45cb42b4c5f097204dc48419
SHA512

8545c8c524c9ee9cdf5a34ee261a997c9100b542845c3f3fec6d1b29d5d6547850f49cfd8b2f42c305f843b9f39a0b2414f340e55ae8d3430c5285799f1ba3ab
SSDEEP

6144:rGdpDpUU6q7riwB6wiEngpakEPBBYPofuVy:ajz7VdmakEPGofay

Score

10^/10

cobaltstrike backdoor trojan

Malware Config

Extracted

Family

cobaltstrike

C2

http://1nevadasports.com:443/dP9p

Attributes

user_agent
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Cobaltstrike family
cobaltstrike

C:\Users\Admin\AppData\Local\Temp\TS-A901.exe
"C:\Users\Admin\AppData\Local\Temp\TS-A901.exe"
1⤵
PID:1860

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1860-0-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download